ef47385f8a
### Why I did it When try to install k8s gpg file, there reports an error. - "E: gnupg, gnupg2 and gnupg1 do not seem to be installed, but one of them is required for this operation curl: (23) Failed writing body". To fix error we need to install gunpg package. But apt-key add is going to be deprecated, mv the gpg file to /etc/apt/trusted.gpg.d/ directly ### How I did it Download k8s gpg file and put it in /etc/apt/trusted.gpg.d/ #### How to verify it We can install k8s gpg file successfully, but no gnupg package installed inside sonic image.
875 lines
39 KiB
Bash
Executable File
875 lines
39 KiB
Bash
Executable File
#!/bin/bash
|
|
## This script is to automate the preparation for a debian file system, which will be used for
|
|
## an ONIE installer image.
|
|
##
|
|
## USAGE:
|
|
## USERNAME=username PASSWORD=password ./build_debian
|
|
## ENVIRONMENT:
|
|
## USERNAME
|
|
## The name of the default admin user
|
|
## PASSWORD
|
|
## The password, expected by chpasswd command
|
|
|
|
## Default user
|
|
[ -n "$USERNAME" ] || {
|
|
echo "Error: no or empty USERNAME"
|
|
exit 1
|
|
}
|
|
|
|
## Password for the default user
|
|
[ -n "$PASSWORD" ] || {
|
|
echo "Error: no or empty PASSWORD"
|
|
exit 1
|
|
}
|
|
|
|
## Include common functions
|
|
. functions.sh
|
|
|
|
## Enable debug output for script
|
|
set -x -e
|
|
|
|
CONFIGURED_ARCH=$([ -f .arch ] && cat .arch || echo amd64)
|
|
|
|
## docker engine version (with platform)
|
|
DOCKER_VERSION=5:24.0.2-1~debian.12~$IMAGE_DISTRO
|
|
CONTAINERD_IO_VERSION=1.6.21-1
|
|
LINUX_KERNEL_VERSION=6.1.0-11-2
|
|
|
|
## Working directory to prepare the file system
|
|
FILESYSTEM_ROOT=./fsroot
|
|
PLATFORM_DIR=platform
|
|
## Hostname for the linux image
|
|
HOSTNAME=sonic
|
|
DEFAULT_USERINFO="Default admin user,,,"
|
|
BUILD_TOOL_PATH=src/sonic-build-hooks/buildinfo
|
|
TRUSTED_GPG_DIR=$BUILD_TOOL_PATH/trusted.gpg.d
|
|
|
|
## Read ONIE image related config file
|
|
. ./onie-image.conf
|
|
[ -n "$ONIE_IMAGE_PART_SIZE" ] || {
|
|
echo "Error: Invalid ONIE_IMAGE_PART_SIZE in onie image config file"
|
|
exit 1
|
|
}
|
|
[ -n "$INSTALLER_PAYLOAD" ] || {
|
|
echo "Error: Invalid INSTALLER_PAYLOAD in onie image config file"
|
|
exit 1
|
|
}
|
|
[ -n "$FILESYSTEM_SQUASHFS" ] || {
|
|
echo "Error: Invalid FILESYSTEM_SQUASHFS in onie image config file"
|
|
exit 1
|
|
}
|
|
|
|
if [ "$IMAGE_TYPE" = "aboot" ]; then
|
|
TARGET_BOOTLOADER="aboot"
|
|
fi
|
|
|
|
## Check if not a last stage of RFS build
|
|
if [[ $RFS_SPLIT_LAST_STAGE != y ]]; then
|
|
|
|
## Prepare the file system directory
|
|
if [[ -d $FILESYSTEM_ROOT ]]; then
|
|
sudo rm -rf $FILESYSTEM_ROOT || die "Failed to clean chroot directory"
|
|
fi
|
|
mkdir -p $FILESYSTEM_ROOT
|
|
mkdir -p $FILESYSTEM_ROOT/$PLATFORM_DIR
|
|
touch $FILESYSTEM_ROOT/$PLATFORM_DIR/firsttime
|
|
|
|
bootloader_packages=""
|
|
if [ "$TARGET_BOOTLOADER" != "aboot" ]; then
|
|
mkdir -p $FILESYSTEM_ROOT/$PLATFORM_DIR/grub
|
|
bootloader_packages="grub2-common"
|
|
fi
|
|
|
|
## ensure proc is mounted
|
|
sudo mount proc /proc -t proc || true
|
|
|
|
## Build the host debian base system
|
|
echo '[INFO] Build host debian base system...'
|
|
TARGET_PATH=$TARGET_PATH scripts/build_debian_base_system.sh $CONFIGURED_ARCH $IMAGE_DISTRO $FILESYSTEM_ROOT
|
|
|
|
# Prepare buildinfo
|
|
sudo SONIC_VERSION_CACHE=${SONIC_VERSION_CACHE} \
|
|
DBGOPT="${DBGOPT}" \
|
|
scripts/prepare_debian_image_buildinfo.sh $CONFIGURED_ARCH $IMAGE_DISTRO $FILESYSTEM_ROOT $http_proxy
|
|
|
|
|
|
sudo chown root:root $FILESYSTEM_ROOT
|
|
|
|
## Config hostname and hosts, otherwise 'sudo ...' will complain 'sudo: unable to resolve host ...'
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo '$HOSTNAME' > /etc/hostname"
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo '127.0.0.1 $HOSTNAME' >> /etc/hosts"
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo '127.0.0.1 localhost' >> /etc/hosts"
|
|
|
|
## Config basic fstab
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c 'echo "proc /proc proc defaults 0 0" >> /etc/fstab'
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c 'echo "sysfs /sys sysfs defaults 0 0" >> /etc/fstab'
|
|
|
|
## Setup proxy
|
|
[ -n "$http_proxy" ] && sudo /bin/bash -c "echo 'Acquire::http::Proxy \"$http_proxy\";' > $FILESYSTEM_ROOT/etc/apt/apt.conf.d/01proxy"
|
|
|
|
trap_push 'sudo LANG=C chroot $FILESYSTEM_ROOT umount /proc || true'
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT mount proc /proc -t proc
|
|
## Note: mounting is necessary to makedev and install linux image
|
|
echo '[INFO] Mount all'
|
|
## Output all the mounted device for troubleshooting
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT mount
|
|
|
|
## Install the trusted gpg public keys
|
|
[ -d $TRUSTED_GPG_DIR ] && [ ! -z "$(ls $TRUSTED_GPG_DIR)" ] && sudo cp $TRUSTED_GPG_DIR/* ${FILESYSTEM_ROOT}/etc/apt/trusted.gpg.d/
|
|
|
|
## Pointing apt to public apt mirrors and getting latest packages, needed for latest security updates
|
|
scripts/build_mirror_config.sh files/apt $CONFIGURED_ARCH $IMAGE_DISTRO
|
|
sudo cp files/apt/sources.list.$CONFIGURED_ARCH $FILESYSTEM_ROOT/etc/apt/sources.list
|
|
sudo cp files/apt/apt-retries-count $FILESYSTEM_ROOT/etc/apt/apt.conf.d/
|
|
sudo cp files/apt/apt.conf.d/{81norecommends,apt-{clean,gzip-indexes,no-languages},no-check-valid-until} $FILESYSTEM_ROOT/etc/apt/apt.conf.d/
|
|
|
|
## Note: set lang to prevent locale warnings in your chroot
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y update
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y upgrade
|
|
|
|
echo '[INFO] Install and setup eatmydata'
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install eatmydata
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT ln -s /usr/bin/eatmydata /usr/local/bin/dpkg
|
|
echo 'Dir::Bin::dpkg "/usr/local/bin/dpkg";' | sudo tee $FILESYSTEM_ROOT/etc/apt/apt.conf.d/00image-install-eatmydata > /dev/null
|
|
## Note: dpkg hook conflict with eatmydata
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT rm /usr/local/sbin/dpkg -f
|
|
|
|
echo '[INFO] Install packages for building image'
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install makedev psmisc
|
|
|
|
if [[ $CROSS_BUILD_ENVIRON == y ]]; then
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT dpkg --add-architecture $CONFIGURED_ARCH
|
|
fi
|
|
|
|
## Create device files
|
|
echo '[INFO] MAKEDEV'
|
|
if [[ $CONFIGURED_ARCH == armhf || $CONFIGURED_ARCH == arm64 ]]; then
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c 'cd /dev && MAKEDEV generic-arm'
|
|
else
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c 'cd /dev && MAKEDEV generic'
|
|
fi
|
|
|
|
## docker and mkinitramfs on target system will use pigz/unpigz automatically
|
|
if [[ $GZ_COMPRESS_PROGRAM == pigz ]]; then
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install pigz
|
|
fi
|
|
|
|
## Install initramfs-tools and linux kernel
|
|
## Note: initramfs-tools recommends depending on busybox, and we really want busybox for
|
|
## 1. commands such as touch
|
|
## 2. mount supports squashfs
|
|
## However, 'dpkg -i' plus 'apt-get install -f' will ignore the recommended dependency. So
|
|
## we install busybox explicitly
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install busybox linux-base
|
|
echo '[INFO] Install SONiC linux kernel image'
|
|
## Note: duplicate apt-get command to ensure every line return zero
|
|
sudo dpkg --root=$FILESYSTEM_ROOT -i $debs_path/initramfs-tools-core_*.deb || \
|
|
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install -f
|
|
sudo dpkg --root=$FILESYSTEM_ROOT -i $debs_path/initramfs-tools_*.deb || \
|
|
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install -f
|
|
sudo dpkg --root=$FILESYSTEM_ROOT -i $debs_path/linux-image-${LINUX_KERNEL_VERSION}-*_${CONFIGURED_ARCH}.deb || \
|
|
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install -f
|
|
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install acl
|
|
if [[ $CONFIGURED_ARCH == amd64 ]]; then
|
|
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install dmidecode hdparm
|
|
fi
|
|
|
|
## Sign the Linux kernel
|
|
# note: when flag SONIC_ENABLE_SECUREBOOT_SIGNATURE is enabled the Secure Upgrade flags should be disabled (no_sign) to avoid conflict between the features.
|
|
if [ "$SONIC_ENABLE_SECUREBOOT_SIGNATURE" = "y" ] && [ "$SECURE_UPGRADE_MODE" != 'dev' ] && [ "$SECURE_UPGRADE_MODE" != "prod" ]; then
|
|
if [ ! -f $SIGNING_KEY ]; then
|
|
echo "Error: SONiC linux kernel signing key missing"
|
|
exit 1
|
|
fi
|
|
if [ ! -f $SIGNING_CERT ]; then
|
|
echo "Error: SONiC linux kernel signing certificate missing"
|
|
exit 1
|
|
fi
|
|
|
|
echo '[INFO] Signing SONiC linux kernel image'
|
|
K=$FILESYSTEM_ROOT/boot/vmlinuz-${LINUX_KERNEL_VERSION}-${CONFIGURED_ARCH}
|
|
sbsign --key $SIGNING_KEY --cert $SIGNING_CERT --output /tmp/${K##*/} ${K}
|
|
sudo cp -f /tmp/${K##*/} ${K}
|
|
fi
|
|
|
|
## Update initramfs for booting with squashfs+overlay
|
|
cat files/initramfs-tools/modules | sudo tee -a $FILESYSTEM_ROOT/etc/initramfs-tools/modules > /dev/null
|
|
|
|
## Hook into initramfs: change fs type from vfat to ext4 on arista switches
|
|
sudo mkdir -p $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/
|
|
sudo cp files/initramfs-tools/arista-convertfs $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/arista-convertfs
|
|
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/arista-convertfs
|
|
sudo cp files/initramfs-tools/arista-hook $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/arista-hook
|
|
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/arista-hook
|
|
sudo cp files/initramfs-tools/mke2fs $FILESYSTEM_ROOT/etc/initramfs-tools/hooks/mke2fs
|
|
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/hooks/mke2fs
|
|
sudo cp files/initramfs-tools/setfacl $FILESYSTEM_ROOT/etc/initramfs-tools/hooks/setfacl
|
|
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/hooks/setfacl
|
|
|
|
# Hook into initramfs: rename the management interfaces on arista switches
|
|
sudo cp files/initramfs-tools/arista-net $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/arista-net
|
|
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/arista-net
|
|
|
|
# Hook into initramfs: resize root partition after migration from another NOS to SONiC on Dell switches
|
|
sudo cp files/initramfs-tools/resize-rootfs $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/resize-rootfs
|
|
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/resize-rootfs
|
|
|
|
# Hook into initramfs: upgrade SSD from initramfs
|
|
sudo cp files/initramfs-tools/ssd-upgrade $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/ssd-upgrade
|
|
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/ssd-upgrade
|
|
|
|
# Hook into initramfs: run fsck to repair a non-clean filesystem prior to be mounted
|
|
sudo cp files/initramfs-tools/fsck-rootfs $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/fsck-rootfs
|
|
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/fsck-rootfs
|
|
|
|
## Hook into initramfs: after partition mount and loop file mount
|
|
## 1. Prepare layered file system
|
|
## 2. Bind-mount docker working directory (docker overlay storage cannot work over overlay rootfs)
|
|
sudo cp files/initramfs-tools/union-mount $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-bottom/union-mount
|
|
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-bottom/union-mount
|
|
sudo cp files/initramfs-tools/varlog $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-bottom/varlog
|
|
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-bottom/varlog
|
|
# Management interface (eth0) dhcp can be optionally turned off (during a migration from another NOS to SONiC)
|
|
#sudo cp files/initramfs-tools/mgmt-intf-dhcp $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-bottom/mgmt-intf-dhcp
|
|
#sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-bottom/mgmt-intf-dhcp
|
|
sudo cp files/initramfs-tools/union-fsck $FILESYSTEM_ROOT/etc/initramfs-tools/hooks/union-fsck
|
|
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/hooks/union-fsck
|
|
pushd $FILESYSTEM_ROOT/usr/share/initramfs-tools/scripts/init-bottom && sudo patch -p1 < $OLDPWD/files/initramfs-tools/udev.patch; popd
|
|
if [[ $CONFIGURED_ARCH == armhf || $CONFIGURED_ARCH == arm64 ]]; then
|
|
sudo cp files/initramfs-tools/uboot-utils $FILESYSTEM_ROOT/etc/initramfs-tools/hooks/uboot-utils
|
|
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/hooks/uboot-utils
|
|
cat files/initramfs-tools/modules.arm | sudo tee -a $FILESYSTEM_ROOT/etc/initramfs-tools/modules > /dev/null
|
|
fi
|
|
# Update initramfs for load platform specific modules
|
|
if [ -f platform/$CONFIGURED_PLATFORM/modules ]; then
|
|
cat platform/$CONFIGURED_PLATFORM/modules | sudo tee -a $FILESYSTEM_ROOT/etc/initramfs-tools/modules > /dev/null
|
|
fi
|
|
|
|
## Add mtd and uboot firmware tools package
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install u-boot-tools libubootenv-tool mtd-utils device-tree-compiler
|
|
|
|
## Install docker
|
|
echo '[INFO] Install docker'
|
|
## Install apparmor utils since they're missing and apparmor is enabled in the kernel
|
|
## Otherwise Docker will fail to start
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install apparmor
|
|
sudo cp files/image_config/ntp/ntp-apparmor $FILESYSTEM_ROOT/etc/apparmor.d/local/usr.sbin.ntpd
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install apt-transport-https \
|
|
ca-certificates \
|
|
curl
|
|
if [[ $CONFIGURED_ARCH == armhf ]]; then
|
|
# update ssl ca certificates for secure pem
|
|
sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT c_rehash
|
|
fi
|
|
sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT curl -o /tmp/docker.asc -fsSL https://download.docker.com/linux/debian/gpg
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT mv /tmp/docker.asc /etc/apt/trusted.gpg.d/
|
|
sudo tee $FILESYSTEM_ROOT/etc/apt/sources.list.d/docker.list >/dev/null <<EOF
|
|
deb [arch=$CONFIGURED_ARCH] https://download.docker.com/linux/debian $IMAGE_DISTRO stable
|
|
EOF
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get update
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install docker-ce=${DOCKER_VERSION} docker-ce-cli=${DOCKER_VERSION} containerd.io=${CONTAINERD_IO_VERSION}
|
|
|
|
install_kubernetes () {
|
|
local ver="$1"
|
|
sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT curl -fsSL \
|
|
https://packages.cloud.google.com/apt/doc/apt-key.gpg | \
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT tee /etc/apt/trusted.gpg.d/kubernetes.asc
|
|
## Check out the sources list update matches current Debian version
|
|
sudo cp files/image_config/kubernetes/kubernetes.list $FILESYSTEM_ROOT/etc/apt/sources.list.d/
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get update
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install kubernetes-cni=${KUBERNETES_CNI_VERSION}
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install kubelet=${ver}
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install kubectl=${ver}
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install kubeadm=${ver}
|
|
}
|
|
|
|
if [ "$INCLUDE_KUBERNETES" == "y" ]
|
|
then
|
|
## Install Kubernetes
|
|
echo '[INFO] Install kubernetes'
|
|
install_kubernetes ${KUBERNETES_VERSION}
|
|
else
|
|
echo '[INFO] Skipping Install kubernetes'
|
|
fi
|
|
|
|
if [ "$INCLUDE_KUBERNETES_MASTER" == "y" ]
|
|
then
|
|
## Install Kubernetes master
|
|
echo '[INFO] Install kubernetes master'
|
|
install_kubernetes ${MASTER_KUBERNETES_VERSION}
|
|
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install hyperv-daemons xmlstarlet parted netcat-openbsd
|
|
sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT curl -o /tmp/cri-dockerd.deb -fsSL \
|
|
https://github.com/Mirantis/cri-dockerd/releases/download/v${MASTER_CRI_DOCKERD}/cri-dockerd_${MASTER_CRI_DOCKERD}.3-0.debian-${IMAGE_DISTRO}_amd64.deb
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install -f /tmp/cri-dockerd.deb
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT rm -f /tmp/cri-dockerd.deb
|
|
else
|
|
echo '[INFO] Skipping Install kubernetes master'
|
|
fi
|
|
|
|
## Add docker config drop-in to specify dockerd command line
|
|
sudo mkdir -p $FILESYSTEM_ROOT/etc/systemd/system/docker.service.d/
|
|
## Note: $_ means last argument of last command
|
|
sudo cp files/docker/docker.service.conf $_
|
|
|
|
## Create default user
|
|
## Note: user should be in the group with the same name, and also in sudo/docker/redis groups
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT useradd -G sudo,docker $USERNAME -c "$DEFAULT_USERINFO" -m -s /bin/bash
|
|
## Create password for the default user
|
|
echo "$USERNAME:$PASSWORD" | sudo LANG=C chroot $FILESYSTEM_ROOT chpasswd
|
|
|
|
## Create redis group
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT groupadd -f redis
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT usermod -aG redis $USERNAME
|
|
|
|
if [[ $CONFIGURED_ARCH == amd64 ]]; then
|
|
## Pre-install hardware drivers
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install \
|
|
firmware-linux-nonfree
|
|
fi
|
|
|
|
## Pre-install the fundamental packages
|
|
## Note: gdisk is needed for sgdisk in install.sh
|
|
## Note: parted is needed for partprobe in install.sh
|
|
## Note: ca-certificates is needed for easy_install
|
|
## Note: don't install python-apt by pip, older than Debian repo one
|
|
## Note: fdisk and gpg are needed by fwutil
|
|
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install \
|
|
file \
|
|
ifmetric \
|
|
iproute2 \
|
|
bridge-utils \
|
|
isc-dhcp-client \
|
|
sudo \
|
|
vim \
|
|
tcpdump \
|
|
dbus \
|
|
ntpstat \
|
|
openssh-server \
|
|
python3-apt \
|
|
traceroute \
|
|
iputils-ping \
|
|
arping \
|
|
net-tools \
|
|
bsdmainutils \
|
|
ca-certificates \
|
|
i2c-tools \
|
|
efibootmgr \
|
|
usbutils \
|
|
pciutils \
|
|
iptables-persistent \
|
|
ebtables \
|
|
logrotate \
|
|
curl \
|
|
kexec-tools \
|
|
less \
|
|
unzip \
|
|
gdisk \
|
|
sysfsutils \
|
|
squashfs-tools \
|
|
$bootloader_packages \
|
|
rsyslog \
|
|
screen \
|
|
hping3 \
|
|
tcptraceroute \
|
|
mtr-tiny \
|
|
locales \
|
|
cgroup-tools \
|
|
ndisc6 \
|
|
makedumpfile \
|
|
conntrack \
|
|
python3 \
|
|
python3-distutils \
|
|
python3-pip \
|
|
python-is-python3 \
|
|
cron \
|
|
libprotobuf32 \
|
|
libgrpc++1 \
|
|
libgrpc29 \
|
|
haveged \
|
|
fdisk \
|
|
gpg \
|
|
jq \
|
|
auditd \
|
|
linux-perf \
|
|
resolvconf \
|
|
lsof \
|
|
sysstat \
|
|
xxd \
|
|
zstd
|
|
|
|
# Have systemd create the auditd log directory
|
|
sudo mkdir -p ${FILESYSTEM_ROOT}/etc/systemd/system/auditd.service.d
|
|
sudo tee ${FILESYSTEM_ROOT}/etc/systemd/system/auditd.service.d/log-directory.conf >/dev/null <<EOF
|
|
[Service]
|
|
LogsDirectory=audit
|
|
LogsDirectoryMode=0750
|
|
EOF
|
|
|
|
# latest tcpdump control resource access with AppArmor.
|
|
# override tcpdump profile to allow tcpdump access TACACS config file.
|
|
sudo cp files/apparmor/usr.bin.tcpdump $FILESYSTEM_ROOT/etc/apparmor.d/local/usr.bin.tcpdump
|
|
|
|
if [[ $CONFIGURED_ARCH == amd64 ]]; then
|
|
## Pre-install the fundamental packages for amd64 (x86)
|
|
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install \
|
|
rasdaemon
|
|
fi
|
|
|
|
## Set /etc/shadow permissions to -rw-------.
|
|
sudo LANG=c chroot $FILESYSTEM_ROOT chmod 600 /etc/shadow
|
|
|
|
## Set /etc/passwd, /etc/group permissions to -rw-r--r--.
|
|
sudo LANG=c chroot $FILESYSTEM_ROOT chmod 644 /etc/passwd
|
|
sudo LANG=c chroot $FILESYSTEM_ROOT chmod 644 /etc/group
|
|
|
|
# Needed to install kdump-tools
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "mkdir -p /etc/initramfs-tools/conf.d"
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo 'MODULES=most' >> /etc/initramfs-tools/conf.d/driver-policy"
|
|
|
|
# Copy vmcore-sysctl.conf to add more vmcore dump flags to kernel
|
|
sudo cp files/image_config/kdump/vmcore-sysctl.conf $FILESYSTEM_ROOT/etc/sysctl.d/
|
|
|
|
#Adds a locale to a debian system in non-interactive mode
|
|
sudo sed -i '/^#.* en_US.* /s/^#//' $FILESYSTEM_ROOT/etc/locale.gen && \
|
|
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT locale-gen "en_US.UTF-8"
|
|
sudo LANG=en_US.UTF-8 DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT update-locale "LANG=en_US.UTF-8"
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT bash -c "find /usr/share/i18n/locales/ ! -name 'en_US' -type f -exec rm -f {} +"
|
|
|
|
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install \
|
|
picocom \
|
|
systemd \
|
|
systemd-sysv \
|
|
ntp
|
|
|
|
if [[ $TARGET_BOOTLOADER == grub ]]; then
|
|
if [[ $CONFIGURED_ARCH == amd64 ]]; then
|
|
GRUB_PKG=grub-pc-bin
|
|
elif [[ $CONFIGURED_ARCH == arm64 ]]; then
|
|
GRUB_PKG=grub-efi-arm64-bin
|
|
fi
|
|
|
|
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get install -d -o dir::cache=/var/cache/apt \
|
|
$GRUB_PKG
|
|
|
|
sudo cp $FILESYSTEM_ROOT/var/cache/apt/archives/grub*.deb $FILESYSTEM_ROOT/$PLATFORM_DIR/grub
|
|
fi
|
|
|
|
## Disable kexec supported reboot which was installed by default
|
|
sudo sed -i 's/LOAD_KEXEC=true/LOAD_KEXEC=false/' $FILESYSTEM_ROOT/etc/default/kexec
|
|
|
|
# Ensure that 'logrotate-config.service' is set as a dependency to start before 'logrotate.service'.
|
|
sudo mkdir $FILESYSTEM_ROOT/etc/systemd/system/logrotate.service.d
|
|
sudo cp files/image_config/logrotate/logrotateOverride.conf $FILESYSTEM_ROOT/etc/systemd/system/logrotate.service.d/logrotateOverride.conf
|
|
|
|
## Remove sshd host keys, and will regenerate on first sshd start
|
|
sudo rm -f $FILESYSTEM_ROOT/etc/ssh/ssh_host_*_key*
|
|
sudo cp files/sshd/host-ssh-keygen.sh $FILESYSTEM_ROOT/usr/local/bin/
|
|
sudo mkdir $FILESYSTEM_ROOT/etc/systemd/system/ssh.service.d
|
|
sudo cp files/sshd/override.conf $FILESYSTEM_ROOT/etc/systemd/system/ssh.service.d/override.conf
|
|
# Config sshd
|
|
# 1. Set 'UseDNS' to 'no'
|
|
# 2. Configure sshd to close all SSH connetions after 15 minutes of inactivity
|
|
sudo augtool -r $FILESYSTEM_ROOT <<'EOF'
|
|
touch /files/etc/ssh/sshd_config/EmptyLineHack
|
|
rename /files/etc/ssh/sshd_config/EmptyLineHack ""
|
|
set /files/etc/ssh/sshd_config/UseDNS no
|
|
ins #comment before /files/etc/ssh/sshd_config/UseDNS
|
|
set /files/etc/ssh/sshd_config/#comment[following-sibling::*[1][self::UseDNS]] "Disable hostname lookups"
|
|
|
|
rm /files/etc/ssh/sshd_config/ClientAliveInterval
|
|
rm /files/etc/ssh/sshd_config/ClientAliveCountMax
|
|
touch /files/etc/ssh/sshd_config/EmptyLineHack
|
|
rename /files/etc/ssh/sshd_config/EmptyLineHack ""
|
|
set /files/etc/ssh/sshd_config/ClientAliveInterval 300
|
|
set /files/etc/ssh/sshd_config/ClientAliveCountMax 0
|
|
ins #comment before /files/etc/ssh/sshd_config/ClientAliveInterval
|
|
set /files/etc/ssh/sshd_config/#comment[following-sibling::*[1][self::ClientAliveInterval]] "Close inactive client sessions after 5 minutes"
|
|
rm /files/etc/ssh/sshd_config/MaxAuthTries
|
|
set /files/etc/ssh/sshd_config/MaxAuthTries 3
|
|
rm /files/etc/ssh/sshd_config/Banner
|
|
set /files/etc/ssh/sshd_config/Banner /etc/issue
|
|
rm /files/etc/ssh/sshd_config/LogLevel
|
|
set /files/etc/ssh/sshd_config/LogLevel VERBOSE
|
|
save
|
|
quit
|
|
EOF
|
|
# Configure sshd to listen for v4 and v6 connections
|
|
sudo sed -i 's/^#ListenAddress 0.0.0.0/ListenAddress 0.0.0.0/' $FILESYSTEM_ROOT/etc/ssh/sshd_config
|
|
sudo sed -i 's/^#ListenAddress ::/ListenAddress ::/' $FILESYSTEM_ROOT/etc/ssh/sshd_config
|
|
|
|
## Config rsyslog
|
|
sudo augtool -r $FILESYSTEM_ROOT --autosave "
|
|
rm /files/lib/systemd/system/rsyslog.service/Service/ExecStart/arguments
|
|
set /files/lib/systemd/system/rsyslog.service/Service/ExecStart/arguments/1 -n
|
|
"
|
|
|
|
sudo mkdir -p $FILESYSTEM_ROOT/var/core
|
|
|
|
# Config sysctl
|
|
sudo augtool --autosave "
|
|
set /files/etc/sysctl.conf/kernel.core_pattern '|/usr/local/bin/coredump-compress %e %t %p %P'
|
|
set /files/etc/sysctl.conf/kernel.softlockup_panic 1
|
|
set /files/etc/sysctl.conf/kernel.panic 10
|
|
set /files/etc/sysctl.conf/kernel.hung_task_timeout_secs 300
|
|
set /files/etc/sysctl.conf/vm.panic_on_oom 2
|
|
set /files/etc/sysctl.conf/fs.suid_dumpable 2
|
|
" -r $FILESYSTEM_ROOT
|
|
|
|
sysctl_net_cmd_string=""
|
|
while read line; do
|
|
[[ "$line" =~ ^#.*$ ]] && continue
|
|
sysctl_net_conf_key=`echo $line | awk -F '=' '{print $1}'`
|
|
sysctl_net_conf_value=`echo $line | awk -F '=' '{print $2}'`
|
|
sysctl_net_cmd_string=$sysctl_net_cmd_string"set /files/etc/sysctl.conf/$sysctl_net_conf_key $sysctl_net_conf_value"$'\n'
|
|
done < files/image_config/sysctl/sysctl-net.conf
|
|
|
|
sudo augtool --autosave "$sysctl_net_cmd_string" -r $FILESYSTEM_ROOT
|
|
|
|
# Specify that we want to explicitly install Python packages into the system environment, and risk breakages
|
|
sudo cp files/image_config/pip/pip.conf $FILESYSTEM_ROOT/etc/pip.conf
|
|
|
|
# For building Python packages
|
|
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install python3-setuptools python3-wheel
|
|
|
|
# docker Python API package is needed by Ansible docker module as well as some SONiC applications
|
|
sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT pip3 install 'docker==6.1.1'
|
|
|
|
# Install scapy
|
|
sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT pip3 install 'scapy==2.4.4'
|
|
|
|
# The option --no-build-isolation can be removed when upgrading PyYAML to 6.0.1
|
|
sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT pip3 install 'PyYAML==5.4.1' --no-build-isolation
|
|
|
|
## Note: keep pip installed for maintainance purpose
|
|
|
|
# Install GCC, needed for building/installing some Python packages
|
|
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install gcc
|
|
|
|
## Create /var/run/redis folder for docker-database to mount
|
|
sudo mkdir -p $FILESYSTEM_ROOT/var/run/redis
|
|
|
|
## Config DHCP for eth0
|
|
sudo tee -a $FILESYSTEM_ROOT/etc/network/interfaces > /dev/null <<EOF
|
|
|
|
auto eth0
|
|
allow-hotplug eth0
|
|
iface eth0 inet dhcp
|
|
EOF
|
|
|
|
sudo cp files/dhcp/rfc3442-classless-routes $FILESYSTEM_ROOT/etc/dhcp/dhclient-exit-hooks.d
|
|
sudo cp files/dhcp/sethostname $FILESYSTEM_ROOT/etc/dhcp/dhclient-exit-hooks.d/
|
|
sudo cp files/dhcp/sethostname6 $FILESYSTEM_ROOT/etc/dhcp/dhclient-exit-hooks.d/
|
|
sudo cp files/dhcp/graphserviceurl $FILESYSTEM_ROOT/etc/dhcp/dhclient-exit-hooks.d/
|
|
sudo cp files/dhcp/snmpcommunity $FILESYSTEM_ROOT/etc/dhcp/dhclient-exit-hooks.d/
|
|
sudo cp files/dhcp/vrf $FILESYSTEM_ROOT/etc/dhcp/dhclient-exit-hooks.d/
|
|
if [ -f files/image_config/ntp/ntpsec ]; then
|
|
sudo cp ./files/image_config/ntp/ntpsec $FILESYSTEM_ROOT/etc/init.d/
|
|
fi
|
|
|
|
if [ -f files/image_config/ntp/ntp-systemd-wrapper ]; then
|
|
sudo cp ./files/image_config/ntp/ntp-systemd-wrapper $FILESYSTEM_ROOT/usr/libexec/ntpsec/
|
|
fi
|
|
|
|
## Version file part 1
|
|
sudo mkdir -p $FILESYSTEM_ROOT/etc/sonic
|
|
if [ -f files/image_config/sonic_release ]; then
|
|
sudo cp files/image_config/sonic_release $FILESYSTEM_ROOT/etc/sonic/
|
|
fi
|
|
|
|
# Default users info
|
|
export password_expire="$( [[ "$CHANGE_DEFAULT_PASSWORD" == "y" ]] && echo true || echo false )"
|
|
export username="${USERNAME}"
|
|
export password="$(sudo grep ^${USERNAME} $FILESYSTEM_ROOT/etc/shadow | cut -d: -f2)"
|
|
j2 files/build_templates/default_users.json.j2 | sudo tee $FILESYSTEM_ROOT/etc/sonic/default_users.json
|
|
sudo LANG=c chroot $FILESYSTEM_ROOT chmod 600 /etc/sonic/default_users.json
|
|
sudo LANG=c chroot $FILESYSTEM_ROOT chown root:shadow /etc/sonic/default_users.json
|
|
|
|
## Copy over clean-up script
|
|
sudo cp ./files/scripts/core_cleanup.py $FILESYSTEM_ROOT/usr/bin/core_cleanup.py
|
|
|
|
## Copy ASIC config checksum
|
|
sudo chmod 755 files/build_scripts/generate_asic_config_checksum.py
|
|
./files/build_scripts/generate_asic_config_checksum.py
|
|
if [[ ! -f './asic_config_checksum' ]]; then
|
|
echo 'asic_config_checksum not found'
|
|
exit 1
|
|
fi
|
|
sudo cp ./asic_config_checksum $FILESYSTEM_ROOT/etc/sonic/asic_config_checksum
|
|
|
|
## Check if not a last stage of RFS build
|
|
fi
|
|
|
|
if [[ $RFS_SPLIT_FIRST_STAGE == y ]]; then
|
|
echo '[INFO] Finished with RFS first stage'
|
|
echo '[INFO] Umount all'
|
|
|
|
## Display all process details access /proc
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT fuser -vm /proc
|
|
## Kill the processes
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT fuser -km /proc || true
|
|
## Wait fuser fully kill the processes
|
|
sudo timeout 15s bash -c 'until LANG=C chroot $0 umount /proc; do sleep 1; done' $FILESYSTEM_ROOT || true
|
|
|
|
sudo rm -f $TARGET_PATH/$RFS_SQUASHFS_NAME
|
|
sudo mksquashfs $FILESYSTEM_ROOT $TARGET_PATH/$RFS_SQUASHFS_NAME -Xcompression-level 1
|
|
|
|
exit 0
|
|
fi
|
|
|
|
if [[ $RFS_SPLIT_LAST_STAGE == y ]]; then
|
|
echo '[INFO] RFS build: second stage'
|
|
|
|
## ensure proc is mounted
|
|
sudo mount proc /proc -t proc || true
|
|
|
|
sudo fuser -vm $FILESYSTEM_ROOT || true
|
|
sudo rm -rf $FILESYSTEM_ROOT
|
|
sudo unsquashfs -d $FILESYSTEM_ROOT $TARGET_PATH/$RFS_SQUASHFS_NAME
|
|
|
|
## make / as a mountpoint in chroot env, needed by dockerd
|
|
pushd $FILESYSTEM_ROOT
|
|
sudo mount --bind . .
|
|
popd
|
|
|
|
trap_push 'sudo LANG=C chroot $FILESYSTEM_ROOT umount /proc || true'
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT mount proc /proc -t proc
|
|
fi
|
|
|
|
## Version file part 2
|
|
export build_version="${SONIC_IMAGE_VERSION}"
|
|
export debian_version="$(cat $FILESYSTEM_ROOT/etc/debian_version)"
|
|
export kernel_version="${kversion}"
|
|
export asic_type="${sonic_asic_platform}"
|
|
export asic_subtype="${TARGET_MACHINE}"
|
|
export commit_id="$(git rev-parse --short HEAD)"
|
|
export branch="$(git rev-parse --abbrev-ref HEAD)"
|
|
export release="$(if [ -f $FILESYSTEM_ROOT/etc/sonic/sonic_release ]; then cat $FILESYSTEM_ROOT/etc/sonic/sonic_release; fi)"
|
|
export build_date="$(date -u)"
|
|
export build_number="${BUILD_NUMBER:-0}"
|
|
export built_by="$USER@$BUILD_HOSTNAME"
|
|
export sonic_os_version="${SONIC_OS_VERSION}"
|
|
j2 files/build_templates/sonic_version.yml.j2 | sudo tee $FILESYSTEM_ROOT/etc/sonic/sonic_version.yml
|
|
|
|
if [ -f sonic_debian_extension.sh ]; then
|
|
./sonic_debian_extension.sh $FILESYSTEM_ROOT $PLATFORM_DIR $IMAGE_DISTRO
|
|
fi
|
|
|
|
## Organization specific extensions such as Configuration & Scripts for features like AAA, ZTP...
|
|
if [ "${enable_organization_extensions}" = "y" ]; then
|
|
if [ -f files/build_templates/organization_extensions.sh ]; then
|
|
sudo chmod 755 files/build_templates/organization_extensions.sh
|
|
./files/build_templates/organization_extensions.sh -f $FILESYSTEM_ROOT -h $HOSTNAME
|
|
fi
|
|
fi
|
|
|
|
## Setup ebtable rules (rule file in text format)
|
|
sudo cp files/image_config/ebtables/ebtables.filter.cfg ${FILESYSTEM_ROOT}/etc
|
|
|
|
## Debug Image specific changes
|
|
## Update motd for debug image
|
|
if [ "$DEBUG_IMG" == "y" ]
|
|
then
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo '**************' >> /etc/motd"
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo 'Running DEBUG image' >> /etc/motd"
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo '**************' >> /etc/motd"
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo '/src has the sources' >> /etc/motd"
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo '/src is mounted in each docker' >> /etc/motd"
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo '/debug is created for core files or temp files' >> /etc/motd"
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo 'Create a subdir under /debug to upload your files' >> /etc/motd"
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo '/debug is mounted in each docker' >> /etc/motd"
|
|
|
|
sudo mkdir -p $FILESYSTEM_ROOT/src
|
|
sudo cp $DEBUG_SRC_ARCHIVE_FILE $FILESYSTEM_ROOT/src/
|
|
sudo mkdir -p $FILESYSTEM_ROOT/debug
|
|
|
|
fi
|
|
|
|
## Set FIPS runtime default option
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "mkdir -p /etc/fips"
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo 0 > /etc/fips/fips_enable"
|
|
|
|
# #################
|
|
# secure boot
|
|
# #################
|
|
if [[ $SECURE_UPGRADE_MODE == 'dev' || $SECURE_UPGRADE_MODE == "prod" && $SONIC_ENABLE_SECUREBOOT_SIGNATURE != 'y' ]]; then
|
|
# note: SONIC_ENABLE_SECUREBOOT_SIGNATURE is a feature that signing just kernel,
|
|
# SECURE_UPGRADE_MODE is signing all the boot component including kernel.
|
|
# its required to do not enable both features together to avoid conflicts.
|
|
echo "Secure Boot support build stage: Starting .."
|
|
|
|
# debian secure boot dependecies
|
|
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install \
|
|
shim-unsigned \
|
|
grub-efi
|
|
|
|
if [ ! -f $SECURE_UPGRADE_SIGNING_CERT ]; then
|
|
echo "Error: SONiC SECURE_UPGRADE_SIGNING_CERT=$SECURE_UPGRADE_SIGNING_CERT key missing"
|
|
exit 1
|
|
fi
|
|
|
|
if [[ $SECURE_UPGRADE_MODE == 'dev' ]]; then
|
|
# development signing & verification
|
|
|
|
if [ ! -f $SECURE_UPGRADE_DEV_SIGNING_KEY ]; then
|
|
echo "Error: SONiC SECURE_UPGRADE_DEV_SIGNING_KEY=$SECURE_UPGRADE_DEV_SIGNING_KEY key missing"
|
|
exit 1
|
|
fi
|
|
|
|
sudo ./scripts/signing_secure_boot_dev.sh -a $CONFIGURED_ARCH \
|
|
-r $FILESYSTEM_ROOT \
|
|
-l $LINUX_KERNEL_VERSION \
|
|
-c $SECURE_UPGRADE_SIGNING_CERT \
|
|
-p $SECURE_UPGRADE_DEV_SIGNING_KEY
|
|
elif [[ $SECURE_UPGRADE_MODE == "prod" ]]; then
|
|
# Here Vendor signing should be implemented
|
|
OUTPUT_SEC_BOOT_DIR=$FILESYSTEM_ROOT/boot
|
|
|
|
if [ ! -f $sonic_su_prod_signing_tool ]; then
|
|
echo "Error: SONiC sonic_su_prod_signing_tool=$sonic_su_prod_signing_tool script missing"
|
|
exit 1
|
|
fi
|
|
|
|
sudo $sonic_su_prod_signing_tool -a $CONFIGURED_ARCH \
|
|
-r $FILESYSTEM_ROOT \
|
|
-l $LINUX_KERNEL_VERSION \
|
|
-o $OUTPUT_SEC_BOOT_DIR \
|
|
$SECURE_UPGRADE_PROD_TOOL_ARGS
|
|
|
|
# verifying all EFI files and kernel modules in $OUTPUT_SEC_BOOT_DIR
|
|
sudo ./scripts/secure_boot_signature_verification.sh -e $OUTPUT_SEC_BOOT_DIR \
|
|
-c $SECURE_UPGRADE_SIGNING_CERT \
|
|
-k $FILESYSTEM_ROOT
|
|
|
|
# verifying vmlinuz file.
|
|
sudo ./scripts/secure_boot_signature_verification.sh -e $FILESYSTEM_ROOT/boot/vmlinuz-${LINUX_KERNEL_VERSION}-${CONFIGURED_ARCH} \
|
|
-c $SECURE_UPGRADE_SIGNING_CERT \
|
|
-k $FILESYSTEM_ROOT
|
|
fi
|
|
echo "Secure Boot support build stage: END."
|
|
fi
|
|
|
|
## Update initramfs
|
|
sudo chroot $FILESYSTEM_ROOT update-initramfs -u
|
|
## Convert initrd image to u-boot format
|
|
if [[ $TARGET_BOOTLOADER == uboot ]]; then
|
|
INITRD_FILE=initrd.img-${LINUX_KERNEL_VERSION}-${CONFIGURED_ARCH}
|
|
KERNEL_FILE=vmlinuz-${LINUX_KERNEL_VERSION}-${CONFIGURED_ARCH}
|
|
if [[ $CONFIGURED_ARCH == armhf ]]; then
|
|
INITRD_FILE=initrd.img-${LINUX_KERNEL_VERSION}-armmp
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT mkimage -A arm -O linux -T ramdisk -C gzip -d /boot/$INITRD_FILE /boot/u${INITRD_FILE}
|
|
## Overwriting the initrd image with uInitrd
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT mv /boot/u${INITRD_FILE} /boot/$INITRD_FILE
|
|
elif [[ $CONFIGURED_ARCH == arm64 ]]; then
|
|
if [[ $CONFIGURED_PLATFORM == pensando ]]; then
|
|
## copy device tree file into boot (XXX: need to compile dtb from dts)
|
|
sudo cp -v $PLATFORM_DIR/pensando/elba-asic-psci.dtb $FILESYSTEM_ROOT/boot/
|
|
## make kernel as gzip file
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT gzip /boot/${KERNEL_FILE}
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT mv /boot/${KERNEL_FILE}.gz /boot/${KERNEL_FILE}
|
|
## Convert initrd image to u-boot format
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT mkimage -A arm64 -O linux -T ramdisk -C gzip -d /boot/$INITRD_FILE /boot/u${INITRD_FILE}
|
|
## Overwriting the initrd image with uInitrd
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT mv /boot/u${INITRD_FILE} /boot/$INITRD_FILE
|
|
else
|
|
sudo cp -v $PLATFORM_DIR/${sonic_asic_platform}-${CONFIGURED_ARCH}/sonic_fit.its $FILESYSTEM_ROOT/boot/
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT mkimage -f /boot/sonic_fit.its /boot/sonic_${CONFIGURED_ARCH}.fit
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
# Collect host image version files before cleanup
|
|
SONIC_VERSION_CACHE=${SONIC_VERSION_CACHE} \
|
|
DBGOPT="${DBGOPT}" \
|
|
scripts/collect_host_image_version_files.sh $CONFIGURED_ARCH $IMAGE_DISTRO $TARGET_PATH $FILESYSTEM_ROOT
|
|
|
|
# Remove GCC
|
|
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y remove gcc
|
|
|
|
# Remove eatmydata
|
|
sudo rm $FILESYSTEM_ROOT/etc/apt/apt.conf.d/00image-install-eatmydata $FILESYSTEM_ROOT/usr/local/bin/dpkg
|
|
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y remove eatmydata
|
|
|
|
## Clean up apt
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y autoremove
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get autoclean
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get clean
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT bash -c 'rm -rf /usr/share/doc/* /usr/share/locale/* /var/lib/apt/lists/* /tmp/*'
|
|
|
|
## Clean up proxy
|
|
[ -n "$http_proxy" ] && sudo rm -f $FILESYSTEM_ROOT/etc/apt/apt.conf.d/01proxy
|
|
|
|
## Clean up pip cache
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT pip3 cache purge
|
|
|
|
## Umount all
|
|
echo '[INFO] Umount all'
|
|
## Display all process details access /proc
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT fuser -vm /proc
|
|
## Kill the processes
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT fuser -km /proc || true
|
|
## Wait fuser fully kill the processes
|
|
sudo timeout 15s bash -c 'until LANG=C chroot $0 umount /proc; do sleep 1; done' $FILESYSTEM_ROOT || true
|
|
|
|
## Prepare empty directory to trigger mount move in initramfs-tools/mount_loop_root, implemented by patching
|
|
sudo mkdir $FILESYSTEM_ROOT/host
|
|
|
|
|
|
if [[ "$CHANGE_DEFAULT_PASSWORD" == "y" ]]; then
|
|
## Expire default password for exitsing users that can do login
|
|
default_users=$(cat $FILESYSTEM_ROOT/etc/passwd | grep "/home"| grep ":/bin/bash\|:/bin/sh" | awk -F ":" '{print $1}' 2> /dev/null)
|
|
for user in $default_users
|
|
do
|
|
sudo LANG=C chroot $FILESYSTEM_ROOT passwd -e ${user}
|
|
done
|
|
fi
|
|
|
|
## Compress most file system into squashfs file
|
|
sudo rm -f $INSTALLER_PAYLOAD $FILESYSTEM_SQUASHFS
|
|
## Output the file system total size for diag purpose
|
|
## Note: -x to skip directories on different file systems, such as /proc
|
|
sudo du -hsx $FILESYSTEM_ROOT
|
|
sudo mkdir -p $FILESYSTEM_ROOT/var/lib/docker
|
|
|
|
## Clear DNS configuration inherited from the build server
|
|
sudo rm -f $FILESYSTEM_ROOT/etc/resolvconf/resolv.conf.d/original
|
|
sudo cp files/image_config/resolv-config/resolv.conf.head $FILESYSTEM_ROOT/etc/resolvconf/resolv.conf.d/head
|
|
|
|
## Optimize filesystem size
|
|
if [ "$BUILD_REDUCE_IMAGE_SIZE" = "y" ]; then
|
|
sudo scripts/build-optimize-fs-size.py "$FILESYSTEM_ROOT" \
|
|
--image-type "$IMAGE_TYPE" \
|
|
--hardlinks var/lib/docker \
|
|
--hardlinks usr/share/sonic/device \
|
|
--remove-docs \
|
|
--remove-mans \
|
|
--remove-licenses
|
|
fi
|
|
|
|
sudo mksquashfs $FILESYSTEM_ROOT $FILESYSTEM_SQUASHFS -comp zstd -b 1M -e boot -e var/lib/docker -e $PLATFORM_DIR
|
|
|
|
## Reduce /boot permission
|
|
sudo chmod -R go-wx $FILESYSTEM_ROOT/boot
|
|
|
|
# Ensure admin gid is 1000
|
|
gid_user=$(sudo LANG=C chroot $FILESYSTEM_ROOT id -g $USERNAME) || gid_user="none"
|
|
if [ "${gid_user}" != "1000" ]; then
|
|
die "expect gid 1000. current:${gid_user}"
|
|
fi
|
|
|
|
# ALERT: This bit of logic tears down the qemu based build environment used to
|
|
# perform builds for the ARM architecture. This must be the last step in this
|
|
# script before creating the Sonic installer payload zip file.
|
|
if [[ $MULTIARCH_QEMU_ENVIRON == y || $CROSS_BUILD_ENVIRON == y ]]; then
|
|
# Remove qemu arm bin executable used for cross-building
|
|
sudo rm -f $FILESYSTEM_ROOT/usr/bin/qemu*static || true
|
|
DOCKERFS_PATH=../dockerfs/
|
|
fi
|
|
|
|
## Compress docker files
|
|
pushd $FILESYSTEM_ROOT && sudo tar -I $GZ_COMPRESS_PROGRAM -cf $OLDPWD/$FILESYSTEM_DOCKERFS -C ${DOCKERFS_PATH}var/lib/docker .; popd
|
|
|
|
## Compress together with /boot, /var/lib/docker and $PLATFORM_DIR as an installer payload zip file
|
|
pushd $FILESYSTEM_ROOT && sudo tar -I $GZ_COMPRESS_PROGRAM -cf platform.tar.gz -C $PLATFORM_DIR . && sudo zip -n .gz $OLDPWD/$INSTALLER_PAYLOAD -r boot/ platform.tar.gz; popd
|
|
sudo zip -g -n .squashfs:.gz $INSTALLER_PAYLOAD $FILESYSTEM_SQUASHFS $FILESYSTEM_DOCKERFS
|